Recover Deleted Items in Exchange Server

Yes, you can recover deleted items in Exchange Server, but the method depends on where the item was deleted from and how long ago. This guide covers the built-in recovery tools in Exchange Server and Outlook, from the Recoverable Items folder to single item recovery, so you can restore emails, contacts, and calendar entries without third-party tools.

How Exchange Server Handles Deletions

When you delete an item in Outlook or Outlook on the web (OWA), it first goes to the Deleted Items folder. Emptying that folder (or pressing Shift+Delete) moves the item to a hidden container called the Recoverable Items folder, which lives in the same mailbox database. This folder has two main subfolders: Deletions and Purges. The Deletions subfolder holds items that were soft-deleted, and the Purges subfolder holds items that were hard-deleted after the retention period expired. Exchange keeps these items for a configurable period, typically 14 days by default, but administrators can extend it up to 30 days in Exchange Server 2013 and later.

Recover from the Deleted Items Folder

The simplest recovery is from the Deleted Items folder itself. In Outlook, open the folder, right-click the item, and select Move > Other Folder to return it to your Inbox or another folder. In OWA, right-click the item and choose Move. If you emptied the Deleted Items folder, you need the Recoverable Items folder, which Outlook exposes through the Recover Deleted Items command. In Outlook desktop, go to the Folder tab and click Recover Deleted Items. In OWA, right-click the Deleted Items folder and select Recover deleted items. This opens a list of items that are still in the Recoverable Items folder. Select the ones you want and click Restore to move them back to their original location.

Single Item Recovery

Single Item Recovery (SIR) is an Exchange feature that keeps a copy of every item that is modified or deleted, even after the retention period for the Recoverable Items folder has passed. It is disabled by default in Exchange Server 2013 and later, but administrators can enable it on a mailbox database or a specific mailbox. When SIR is on, the Purges subfolder retains items for the duration of the SingleItemRecoveryPeriod (default 14 days). To recover an item that has been purged, an administrator must use the Search-Mailbox cmdlet with the -SearchDumpster parameter or use the eDiscovery Center in the Exchange Admin Center. This is a powerful tool for legal holds and compliance, but it requires administrative access and is not something the average user can do from Outlook.

Use the Exchange Admin Center

For items that are beyond the user-accessible recovery window, an Exchange administrator can use the Exchange Admin Center (EAC) to search and recover. In the EAC, go to Compliance Management > In-Place eDiscovery & Hold. Create a new search, specify the mailbox, and set the search criteria to include the Recoverable Items folder. Once the search completes, you can export the results to a PST file or copy them to a discovery mailbox. This method works for items that are still within the retention period, even if they were purged from the Deletions subfolder. For items that are older than the retention period and SIR is not enabled, the data is gone and cannot be recovered without a backup.

Restore from Backup

If the item is not recoverable through any of the above methods, the last resort is restoring the mailbox database from a backup. Exchange Server supports two types of backups: full backups and copy backups. A full backup captures the entire database and transaction logs, allowing you to restore the database to a specific point in time. A copy backup is similar but does not truncate the transaction logs. To restore a single mailbox or item, you typically restore the database to a recovery database (RDB) and then use the New-MailboxRestoreRequest cmdlet to extract the specific data. This process is time-consuming and requires a recent backup, but it is the only way to recover items that have been permanently purged and are past the retention period.

Common Problems and Misconceptions

One common misconception is that emptying the Deleted Items folder permanently deletes the items. In reality, they remain in the Recoverable Items folder until the retention period expires. Another issue is that the Recover Deleted Items command in Outlook only shows items that are in the Recoverable Items folder. If you have enabled the Empty Deleted Items folder on exit option, Outlook may automatically purge items before you have a chance to recover them. Also, if the mailbox is on a server that has the RetentionPolicy set to permanently delete items after a certain number of days, the items may be purged sooner than the default 14 days. To avoid losing data, check the mailbox retention policy and consider enabling Single Item Recovery for important mailboxes.

Frequently Asked Questions

How long are deleted items kept in Exchange Server? By default, items in the Recoverable Items folder are kept for 14 days. This is controlled by the RetainDeletedItemsFor property on the mailbox database. Administrators can change this value up to 30 days in Exchange Server 2013 and later. After that period, items are permanently purged unless Single Item Recovery is enabled.

Can I recover items deleted from a shared mailbox? Yes, the same recovery methods apply to shared mailboxes. If you have Full Access permission to the shared mailbox, you can use Outlook or OWA to recover deleted items. Otherwise, an administrator can perform a search and recovery using the Exchange Admin Center.

Why doesn’t the Recover Deleted Items command show any items? This usually means the items have been purged from the Recoverable Items folder, either because the retention period has expired or because the mailbox has a policy that permanently deletes items. It could also be that the items were deleted from a different mailbox or folder that is not covered by the current view.

Does Single Item Recovery work for items deleted from the Deleted Items folder? Yes, Single Item Recovery captures any item that is modified or deleted, including those in the Deleted Items folder, as long as the item was in the mailbox when the modification or deletion occurred. The item is kept in the Purges subfolder for the SingleItemRecoveryPeriod.

Can I recover a deleted item after the retention period if I have a backup? Yes, if you have a backup that predates the deletion, you can restore the mailbox database to a recovery database and extract the item. This is the only way to recover items that are past the retention period and not covered by Single Item Recovery.

Related

• Redmi Note 14 Pro vs Vivo T4 Pro: Key Specs
• Skullcandy Crusher 1080 ANC: Who Should Buy It?
• Talon Strike Unlock in Where Winds Meet